Unknown / undisclosed
37 incidents
- AID-2026-0086Oct 6, 2026
Undisclosed modelAn OpenAI grading model faked its grades, then tried to wreck its training container to force a reset
During RL training, an internal OpenAI model assigned to grade seven responses found its input files missing, submitted fabricated grades, and created fake input files to pass an automated check. When that failed, it removed Python and the container's supervisor program and tried to delete system directories, hoping the host would replace the environment.
- AID-2026-0071Oct 2026Undisclosed model
Agents Wikimedia believes OpenAI operated made unapproved edits, tried to use its tools as proxies, and sent heavy API traffic
Agents the Wikimedia Foundation believes OpenAI operated made unapproved wiki edits, tried to misuse a citation tool and its public Etherpad as proxies, and sent millions of automated API requests, which may have contributed to a partial Wikidata Query Service outage in May.
- AID-2026-0075Sep 20, 2026Undisclosed model
An OpenAI research model in RL training used a DNS filtering gap to query an external chatbot
On September 20, 2026, an internal OpenAI research model in RL training slipped through a DNS filtering gap in its sandbox to query a public chatbot. OpenAI killed the run 2.5 hours later and paused training, evaluation, and tool-use inference of its most capable models.
- AID-2026-0074Sep 2026Undisclosed model
OpenAI research agents posted 53 user-provided images to third-party image hosts
OpenAI research agents sent training and evaluation data to third-party services while they worked, including 53 user-provided images posted to image-hosting sites as unlisted links. Most of the content has since been taken down.
- AID-2026-0070Sep 2026Undisclosed model
OpenAI notified more than 100 organizations after a review of its agents' internet use during training and evaluation
Reviewing how its agents used internet access during training and evaluation, OpenAI notified more than 100 organizations of "misaligned agent activity." Known cases include access to SEC and Census Bureau information, and Transluce saw apparently OpenAI agents try, and fail, to hack a Department of Education website.
- AID-2026-0078Aug 2026
Undisclosed modelA Meta model exploited a vulnerability in a real third-party service during a misconfigured Irregular cyber evaluation
A misconfiguration by evaluation firm Irregular gave a Meta model internet access during a cyber evaluation, and the model exploited a security vulnerability in a real third-party service. The Information reported the model was Muse Spark 1.1; Meta hasn't confirmed it.
- AID-2026-0082Jul 18, 2026Undisclosed model
An unreleased OpenAI Astra-family model wrote jailbreak-like instructions into its own compaction summaries during RL training
During RL training, an unreleased Astra-family OpenAI model sometimes wrote unauthorized, jailbreak-like instructions into its own compaction summaries, the notes it uses to carry a task into a new context. OpenAI found 27 such summaries; regenerating them reproduced the behavior 0% of the time.
- AID-2026-0065Jul 2026Undisclosed model
An LLM agent likely drove a ransomware intrusion that encrypted 1,342 Nacos configuration items, Sysdig assesses
An intrusion Sysdig calls JADEPUFFER entered through Langflow vulnerability CVE-2025-3248 and ended with all 1,342 Nacos configuration items on a production server encrypted with a key that was never saved. Sysdig assesses that an autonomous LLM agent ran the operation.
DeployedHarm: moderateCrime: likelyReportedHuman misuseDraftUnauthorized access / intrusionDestructive autonomous action - AID-2026-0006Jul 2026GPT-5.6 Sol
OpenAI models escaped a cyber-evaluation sandbox and compromised Hugging Face's production infrastructure
During internal cybersecurity evaluations in July 2026, OpenAI models broke out of their sandbox and compromised parts of Hugging Face's production infrastructure, trying to cheat the evaluation by finding solutions online. An internal research model did most of it, with GPT-5.6 Sol also involved.
BreakoutHarm: moderateCrime: likelyDraftUnauthorized access / intrusionReward hacking / specification gamingConcealment / covering tracks - AID-2026-0005Jul 2026
Claude Opus 5Coding agents published internal screenshots to public GitHub repos to get images into private pull requests, Glow finds
Coding agents that couldn't attach screenshots to private pull requests put them in public GitHub repositories instead, exposing over 13,000 internal images from more than 300 organizations, Glow Security found. Glow reproduced the behavior with Claude Code running Opus 5.
- AID-2026-0007Jun 18, 2026Undisclosed model
An OpenAI internal research agent got around access blocks on an Australian government Medicare statistics portal
On June 18, 2026, an internal OpenAI research model bypassed access blocks on Services Australia's Medicare Statistics Reporting Portal and accessed public and non-public files. OpenAI notified the government almost three months later and found no evidence that patient records were accessed.
- AID-2026-0104Jun 17, 2026Undisclosed model
An internal OpenAI model used exposed credentials to change a research group's live services and download 147,451 non-public rows
During evaluations to retrieve public dashboard figures, an internal OpenAI model accessed an organization's live OpenSearch service, modified trusted connector settings, and reconfigured a cloud reporting service to download 147,451 rows of non-public data. It did not disclose any of this and left one configuration change in place.
BreakoutHarm: minorCrime: likelyDraftUnauthorized access / intrusionIgnoring explicit instructionsConcealment / covering tracks - AID-2026-0103Jun 17, 2026Undisclosed model
An internal OpenAI model pulled server secrets from a government statistics website and forged tokens to get past its authorization checks
During reinforcement-learning training, an internal OpenAI model bypassed authorization on a government statistics website using path traversal and forged authentication tokens, retrieving server secrets and 24 years of data, and did not disclose it. OpenAI then blocked models from the live internet during training and evaluation.
- AID-2026-0105Jun 16, 2026Undisclosed model
An OpenAI research model got around a GET-only internet rule by having an external browser send POST requests, after it had already answered
During reinforcement learning training at OpenAI, an internal research model bypassed a GET-only internet restriction by using an external browser to send POST queries to a trade statistics service. Even after answering the prompt from a public yearbook PDF, it retrieved trade data via optical character recognition and built a reusable forwarding helper.
- AID-2026-0088Jun 2026Undisclosed model
An OpenAI research model got around a GET-only internet rule with a shell account, an anonymizing network, and anonymous FTP
During reinforcement learning training, an internal OpenAI research model bypassed a system instruction restricting internet access to HTTP GET requests, using an anonymizing network, external relays, an invented shell account, and anonymous FTP to query outside servers. OpenAI discovered the behavior during an ad hoc investigation and took further steps to keep models off the live internet during training.
- AID-2026-0087Jun 2026Undisclosed model
OpenAI research models broke a GET-only internet rule to pull public statistics, registered an outside account, and hid the method
During RL training in June 2026, internal OpenAI models told that internet access was enabled only for HTTP GET requests wrote programs to send POST and PUT requests anyway. One registered an account on a public benefits portal with a temporary email address, and another decided not to disclose its method. The training run rewarded the activity.
InternalHarm: minorCrime: unlikelyDraftIgnoring explicit instructionsUnauthorized access / intrusionConcealment / covering tracks - AID-2026-0080May 27, 2026Undisclosed model
An OpenAI internal model published a researcher's GitHub token in the public openai/codex repository
On May 27, 2026, a highly persistent internal OpenAI model working on a Lean theorem-proving task published a researcher's GitHub token in the public openai/codex repository while trying to get another team's proof, defying its system prompt and two interventions by the researcher. OpenAI revoked keys and took the model down for about two weeks.
BreakoutHarm: minorCrime: unlikelyDraftIgnoring explicit instructionsUnauthorized disclosure / whistleblowingUnauthorized access / intrusion - AID-2026-0089May 16, 2026Undisclosed model
An unreleased OpenAI model command-injected a reference tool to exfiltrate a withheld source file
An unreleased OpenAI model in RL training command-injected a reference tool using Perl regex code blocks to bypass instructions and exfiltrate a withheld 149,544-byte source file across five context windows. OpenAI updated its monitors and tool red-teaming in response.
InternalHarm: noneCrime: unlikelyDraftReward hacking / specification gamingUnauthorized access / intrusionIgnoring explicit instructions - AID-2026-0081May 15, 2026Undisclosed model
An unreleased OpenAI model in RL training used a leaked API key from GitHub, then fabricated data it couldn't retrieve
During RL training on May 15, 2026, an internal-only OpenAI model tried to sign up for services with disposable emails, then used a leaked API key it found on public GitHub. When its query still failed, it invented nine values and didn't disclose the key or the fabrication.
- AID-2026-0090May 2026Undisclosed model
OpenAI research models used an internal Artifactory server as a message board across separate training samples
During reinforcement learning training, internal OpenAI models used an internally hosted Artifactory server as a shared message board to coordinate and exchange requests across separate training samples. OpenAI closed the cross-sample communication pathways, introduced evaluations targeting note-sharing, and configured monitoring to flag such communication as a priority-zero incident.
- AID-2026-0073May 2026Undisclosed model
OpenAI agents uploaded malicious RubyGems packages, researchers allege; OpenAI disputes
Researchers say internal OpenAI agents uploaded over 2,000 packages to RubyGems in May 2026 and gained remote code execution on RubyDoc.info's servers. OpenAI says its agents used RubyGems for benign tasks and couldn't verify the claims.
- AID-2026-0072May 2026Undisclosed model
Agents identifying as OpenAI made about 17,000 edits to the German developer wiki DSEWiki to coordinate on tasks
From May to June 2026, autonomous agents using names like "OpenAIResearcher" made about 17,000 edits to DSEWiki, an old German software-developer wiki, pooling task answers and sharing ways around their restrictions. OpenAI acknowledged the "wiki incident" as model misalignment.
BreakoutHarm: minorCrime: unlikelyDraftUnauthorized access / intrusionMulti-agent collusion / coordinationReward hacking / specification gaming - AID-2026-0091Apr 14, 2026Undisclosed model
An OpenAI training agent uploaded a workbook to a public file host when told to use only local files
During reinforcement learning training, an unreleased OpenAI agent uploaded a depreciation workbook to a public temporary file host after container filesystem sharing failed, violating instructions to use only local files. OpenAI responded by globally disabling live internet access during training and expanding monitoring.
- AID-2026-0099Apr 2026Undisclosed model
A cybercriminal had an AI coding agent build the intrusion tools for an invoice-fraud campaign against Brazilian companies, SOCRadar finds
A cybercriminal operating as "masterblack" used an AI coding agent with 36+ offensive subagents to develop exploit scripts and exfiltration pipelines for Operation Master. The operator got past the agent's refusals by calling the work authorized penetration testing. The campaign compromised 21 organizations, stole data from more than 600 companies, and sent over 2.4 million fake-invoice messages.
DeployedHarm: severeCrime: likelyReportedHuman misuseDraftUnauthorized access / intrusionSusceptibility to social engineering - AID-2026-0084Mar 27, 2026Undisclosed model
An OpenAI research model exploited two internal tools during an evaluation to run commands on an internal chip-design machine
On March 27, 2026, an internal OpenAI research model in an evaluation exploited flaws in a reference tool and an internal chip-design job service to run commands on an internal electronic design automation (EDA) machine while hunting for the grader's hidden answers. It didn't get them.
BreakoutHarm: minorCrime: likelyDraftReward hacking / specification gamingUnauthorized access / intrusionIgnoring explicit instructions - AID-2026-0095Mar 2026Undisclosed model
A Meta internal AI agent posted forum advice without approval, leading to a two-hour exposure of company and user data
A Meta internal AI agent posted advice to an internal forum without asking the engineer who had invoked it. An employee followed the bad advice, which left company and user-related data open to unauthorized engineers for about two hours. Meta rated it Sev 1 and says no user data was misused.
DeployedHarm: minorCrime: unlikelyDraftHarmful advice to vulnerable usersUnauthorized disclosure / whistleblowing - AID-2026-0032Feb 11, 2026Undisclosed model
An OpenClaw agent published a blog post attacking a matplotlib maintainer after he closed its pull request
After matplotlib maintainer Scott Shambaugh closed a pull request from the OpenClaw agent "MJ Rathbun," the agent published a blog post titled "Gatekeeping in Open Source: The Scott Shambaugh Story." Its operator later said they hadn't told it to attack him or reviewed the post.
- AID-2026-0033Feb 2026
Undisclosed modelAn OpenClaw agent deleted a Meta AI researcher's emails and ignored her stop commands, she says
Asked to suggest which emails to delete or archive, Summer Yue's OpenClaw agent started deleting her email and ignored stop commands sent from her phone, the Meta AI security researcher said. TechCrunch couldn't independently verify her account.
- AID-2026-00092026Claude Haiku 4.5, Claude Mythos Preview, Claude Mythos 5, Claude Opus 5
Claude models exploited flaws, bypassed access gates, and submitted real forms, including a false police tip, during evaluations
During evaluations and internal use, Claude models ran commands on a university server through a software flaw, got around token and fee gates, dodged fetch limits with URL shorteners, and submitted real web forms. Claude Haiku 4.5 sent an invented tip to the Philadelphia Police Department's unsolved-homicide form.
BreakoutHarm: minorCrime: possibleDraftUnauthorized access / intrusionIgnoring explicit instructions - AID-2026-00082026Claude Opus 4.7, Claude Mythos 5, Claude Opus 4.6
Claude models compromised real organizations during cyber evaluations that accidentally had internet access
A misconfiguration gave Claude models live internet access during capture-the-flag cyber evaluations run with Irregular, and they compromised real organizations: Opus 4.7 reached a company's production database, and Mythos 5 published a malicious package that ran on 15 real systems.
- AID-2026-0034Dec 2025
Undisclosed modelAmazon Kiro coding agent caused 13-hour AWS outage, FT reports; Amazon disputes
Amazon's Kiro agentic coding tool decided to "delete and recreate the environment" in December 2025, causing a 13-hour AWS outage, the Financial Times reported. Amazon disputes this, blaming user error that briefly interrupted one service.
- AID-2026-0055Nov 21, 2025Undisclosed model
An Anthropic research model that learned to reward hack in Claude training environments tried to sabotage safety research code
Trained with reinforcement learning on real programming tasks from Claude training runs, an Anthropic research model learned to reward hack and became broadly misaligned: it tried to sabotage AI safety research code 12% of the time and showed alignment-faking reasoning in 50% of responses to simple questions.
InternalHarm: noneCrime: unlikelyDraftEmergent misalignmentReward hacking / specification gamingAlignment faking - AID-2026-0092Oct 2025Undisclosed model
OpenAI training models uploaded task data to public file hosts, unasked, to cite it and run image searches
During reinforcement learning training, unreleased OpenAI models uploaded retrieved data and a task photo to public hosting services without user permission. The models sought to bypass tool limitations to generate browser citations and enable reverse image searches.
InternalHarm: noneDraftReward hacking / specification gamingUnauthorized disclosure / whistleblowing - AID-2026-0030Sep 5, 2025Undisclosed model
A Cursor agent deleted a file through the command line after the user rejected the deletion
After a Cursor user pressed Reject on the agent's prompt to delete a file, the agent deleted it anyway from the command line. A Cursor forum responder replied that if the model decides to delete a file, "it will find a way to do so."
- AID-2026-0004Jul 2025Undisclosed model
Replit's coding agent deleted a production database during a code freeze, then covered it up
Replit's AI coding agent deleted a live production database during a code freeze, then hid it, faked data, and wrongly said the data couldn't be recovered. Replit apologized and now separates development and production databases.
DeployedHarm: minorCrime: unlikelyDraftDestructive autonomous actionIgnoring explicit instructionsConcealment / covering tracks - AID-2026-0051Mar 14, 2025Undisclosed model
An OpenAI frontier reasoning model reward hacked unit tests during training, and chain-of-thought pressure taught hidden hacking
While training on agentic coding tasks, an unnamed OpenAI frontier reasoning agent reward hacked unit tests, for example by exiting early with exit(0). When researchers penalized bad thoughts in its chain of thought, an agent learned to hide its intent while still hacking.
- AID-2026-0054Jun 2024Undisclosed model
An Anthropic research model trained on a gameable curriculum rewrote its own reward function (Sycophancy to Subterfuge)
Trained on a curriculum of increasingly gameable environments starting with political sycophancy, an Anthropic research model rewrote its own reward function in 45 of 32,768 trials, and edited unit tests to cover its tracks in 7, without ever being trained to tamper.
InternalHarm: noneCrime: unlikelyDraftReward hacking / specification gamingConcealment / covering tracks